LegalLead360 Legal
Security at Lead360
Review Lead360 tenant security, encrypted backups, recovery testing, privacy operations, external assurance programs, incident response, and customer responsibilities.
Lead360 operates layered tenant safeguards, encrypted credential and backup controls, recurring recovery evidence, privacy operations, and a shared responsibility model. External reports and certifications are tracked separately from operating controls.
Security approach
Lead360 designs security around authenticated access, tenant separation, least-privilege permissions, controlled provider access, logging, backup and recovery, and incident response. Safeguards are reviewed as the service changes and are selected according to data sensitivity, feature risk, and operational needs.
Assurance program status
The following status is current as of August 29, 2026. Lead360 distinguishes controls that operate today from independent examinations and certifications performed by external organizations.
Lead360 maintains documented controls, recurring evidence, encrypted backup verification, restore exercises, and sensitive-field reviews for an independent SOC 2 Type I examination. No SOC 2 report has been issued.
Recurring control evidence and recovery records are collected as part of normal operations. Formal observation dates and examination scope are established with the selected CPA firm. No SOC 2 Type II report has been issued.
Lead360 is preparing its production cloud application and web-accessible APIs for a CASA AL2 assessment. An authorized lab will confirm the assessment profile, scope, testing requirements, and evidence. No CASA certificate has been issued.
Information-security policies, risk treatment, evidence, recovery, access, incident, vendor, and change controls are maintained as an information security management system. Accredited certification-body selection and certification scoping are the current external assurance steps. No ISO/IEC 27001 certificate has been issued.
Data rights, processor terms, retention, erasure, transfer, vendor, incident, and accountability procedures operate across the service and remain under continuing legal review. Any voluntary Article 42 certification is a separate scoped assessment through an approved scheme.
Notices, consumer requests, correction, deletion, opt-out, sensitive-data, retention, and service-provider controls operate across the privacy program. Applicability, required risk assessments, audits, and filings are reviewed against current California thresholds and regulations.
Current safeguards
| Area | Safeguards |
|---|---|
| Identity and access | Authenticated sessions, role and scope checks, tenant binding, administrator controls, provider OAuth, and account-access logging. |
| Network and transport | HTTPS/TLS for public services, reverse proxy controls, Cloudflare traffic protection, request validation, and webhook verification where configured. |
| Application and tenant controls | Sub-account boundaries, permission checks, server-side validation, controlled operation scopes, confirmation gates, and rate or provider limits. |
| Credentials | Restricted secret configuration, application-layer encryption for reviewed stored credential fields, token rotation capabilities, and masked interfaces. |
| Monitoring and audit | Security, access, automation, AI, provider, and operational logs appropriate to the feature. |
| Availability and recovery | Encrypted MySQL, service-configuration, and durable-file backup envelopes, private offsite copies, isolated restore exercises, service restarts, persistent databases, and provider redundancy where available. |
| Development and change control | Source review, validation, compilation, linting, testing, staged feature flags, and production verification appropriate to the change. |
Encryption statement
Lead360 uses HTTPS/TLS for public web traffic, application-layer encryption for reviewed stored credential fields, and encrypted envelopes for current MySQL, service-configuration, and durable-file backups. Verified encrypted copies are maintained in private offsite object storage. Lead360 does not represent that every active database tablespace, host or container volume, recording, vector, export, provider system, or historical artifact is encrypted at rest. Customers with a contractual encryption-at-rest requirement must obtain written confirmation for the specific data path before use.
AI, automation, and provider risk
AI and automation can send data or take actions quickly. Customers must limit tools and scopes, test in a controlled account, review model outputs, require confirmation for material actions, and inspect run history. Connected providers maintain their own security and retention controls. Lead360 may disable a provider or operation when it presents unacceptable risk.
Incidents and notification
Lead360 investigates suspected unauthorized access, loss, misuse, or service disruption; contains confirmed incidents; preserves relevant evidence; remediates identified issues; and provides notices required by contract or law. Customers must promptly report suspected compromise and cooperate with containment, credential rotation, and legally required notification.
Independent assurance and compliance claims
The assurance labels on this page describe the current program stage and do not represent an issued report or certificate. Lead360 does not claim SOC 2, ISO/IEC 27001, CASA, PCI certification for the entire platform, HIPAA certification, or universal GDPR, CCPA, or PHIPA compliance unless a current written statement expressly confirms the status, date, scope, and issuing organization. Payment and infrastructure providers may maintain their own certifications. No badge or provider eligibility makes a customer use automatically compliant.
Report a vulnerability
Send suspected vulnerabilities to [email protected] with the subject Security Report. Include the affected URL or feature, steps to reproduce, observed impact, and contact information. Do not access another account, retain personal data, disrupt service, use social engineering, or publicly disclose an unresolved issue. Lead360 will acknowledge and triage good-faith reports.
Contact
Questions about this document
Email [email protected] and include the document name, customer account, and the issue you want us to review. Do not send passwords, private keys, payment credentials, or PHI.
Contact Lead360